740 matches found
DouCo DouPHP 跨站脚本漏洞
DouCo DouPHP is a lightweight enterprise content management system CMS from China's DouShell Network Technology Company. A security vulnerability exists in DouPHP v1.7, which stems from the presence of a stored cross-site scripting XSS vulnerability that allows an attacker to execute arbitrary we...
F5 BIG-IP 跨站脚本漏洞
F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. F5 BIG-IP suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and...
PT-2023-22642 · Emlog Pro · Emlog Pro
Name of the Vulnerable Software and Affected Versions: Emlog Pro version 2.0.3 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Article Title or Article Summary parameters. This enables the execution of malicious scripts,...
DirCMS Cross-Site Scripting Vulnerability
DirCMS is a website builder from the Latvian company DirCMS. A cross-site scripting vulnerability exists in DirCMS version 6.0.0, which stems from the lack of effective filtering and escaping of user-supplied data in the front-end, and can be exploited by an attacker to execute arbitrary Web scri...
zstore 6.6.0 - Cross-Site Scripting (XSS)
Exploit Title: zstore 6.6.0 - Cross-Site Scripting XSS Development: nu11secur1ty Date: 01.29.2023 Vendor: https://zippy.com.ua/ Software: https://github.com/leon-mbs/zstore/releases/tag/6.5.4 Reproduce: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/zippy/zstore-6.5.4...
CVE-2023-27059
A cross-site scripting XSS vulnerability in the Edit Group function of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit Group Name text field...
Online Pizza Ordering System 跨站脚本漏洞
Online Pizza Ordering System is an online pizza ordering system by Carlo Montero, a personal developer. A security vulnerability exists in Online Pizza Ordering System version 1.0, which originates from a cross-site scripting XSS vulnerability in /php-opos/login.php, which can be exploited by an...
PT-2023-14666 · Artica · Pandora Fms
Name of the Vulnerable Software and Affected Versions: Artica PFMS Pandora FMS version v765 Description: The issue is related to improper neutralization of input during web page generation, allowing Cross-Site Scripting XSS. A user with edition privileges can create a payload in the reporting...
CVE-2023-24230
A stored cross-site scripting XSS vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title parameter...
Art Gallery Management System 跨站脚本漏洞
Art Gallery Management System is an art gallery management system by Anuj Kumar, an individual developer. A security vulnerability exists in Art Gallery Management System v1.0, which originates from a Reflected Cross Site Scripting XSS vulnerability. The vulnerability can be exploited by an...
Inventory Management System 跨站脚本漏洞
Inventory Management System is an inventory management system by stemword individual developers. A security vulnerability exists in Inventory Management System v1. An attacker can exploit this vulnerability to execute arbitrary web script or HTML by injecting a specially crafted payload into the...
CVE-2023-24233
A stored cross-site scripting XSS vulnerability in the component /php-inventory-management-system/orders.php?o=add of Inventory Management System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Client Name parameter...
CVE-2023-22975
A cross-site scripting XSS vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter under /front/person/profile.html...
Revenue Collection System 跨站脚本漏洞
Revenue Collection System is a landed property billing and payment software by Carlo Montero Individual Developer. A security vulnerability exists in Revenue Collection System v1.0, which stems from its /index.php?page=help component that allows an attacker to execute arbitrary web script or HTML...
Small CRM 跨站脚本漏洞
PHPGurukul Small CRM is a customer relationship management system. A security vulnerability exists in Small CRM v3.0, which stems from the Subject parameter of its Create Ticket page that allows an attacker to inject a crafted payload to execute arbitrary web script and HTML...
CVE-2022-46438
A cross-site scripting XSS vulnerability in the /admin/articlecategory.php component of DouPHP v1.7 20221118 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the description parameter...
Online Student Enrollment System 跨站脚本漏洞
Online Student Enrollment System is an online student enrollment system by Lyndon Bermoy Individual Developer. A security vulnerability exists in Online Student Enrollment System version v1.0, which stems from a cross-site scripting XSS vulnerability in the component /admin /register.php that...
Stored XSS via title, subtitle, footer and post title and content
Description The site is vulnerable to Stored XSS via Blog title, Blog subtitle and Blog footer. Proof of Concept - Login as Admin - Go to Administration Area - Option Set n the 3 fields a payload like this: alertdocument.domain Now go to the blog, and you'll see that 3 payloads actually fires: Al...
WCK < 2.3.3 - Admin+ Stored XSS
The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example, in multisite setup. 1. Create/edit a Post Type via the plugin...
